Use After Free in DSP Service

Use After Free in Graphics

Buffer Copy Without Checking Size of Input in Powerline Communication Firmware

Memory corruption in modem due to improper length check while copying into memory

Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music

Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music

Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music

Memory corruption in Bluetooth HOST due to stack-based buffer overflow when when extracting data using command length parameter in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Cryptographic issue occurs due to use of insecure connection method while downloading

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon Industrial IOT

Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired…

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Improper access control in trusted application environment can cause unauthorized access to CDSP or ADSP VM memory with either privilege in Snapdragon Auto, Snapdragon Compute,…

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute,…

Out-of-bounds Write in HLOS

Buffer Copy Without Checking Size of Input in Automotive Platform

Improper Release of Memory Before Removing Last Reference in Graphics

Double Free in Graphics

Buffer Copy Without Checking Size of Input in DSP Service

Buffer Copy without Checking Size of Input in DSP Service

Incorrect Authorization in Boot

Out-of-bounds Write in Audio

Use After Free in Video

Out-of-bounds Write in DSP Service

Use After Free in Camera Driver

Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor

Use After Free in BTHOST

Use After Free in NPU

Use After Free in NPU

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling

Memory corruption while prociesing command buffer buffer in OPE module

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error

Memory corruption during GNSS HAL process initialization

Memory corruption while processing GPU page table switch